MCP Release v0.3.0

MCP Release v0.3.0 adds configuration-file based scenario testing, authenticated endpoint validation, detailed resilience controls (retries, Retry-After, per-timeout classification), hard scenario deadlines, and expanded redaction. All existing HTTP and stdio checks continue to work without modification.

Configuration-file scenarios

Run multiple named checks — authenticated, unauthenticated, and expected-failure — in a single command:

mcp-release check --config mcp-release.config.yml

Example configuration:

server:
  url: https://your-server.example.com/mcp

scenarios:
  - name: anonymous
    expect:
      result: warning
      httpStatus: 401

  - name: authenticated
    headers:
      Authorization: "Bearer ${MCP_TOKEN}"
    expect:
      result: pass

  - name: read-only
    headers:
      Authorization: "Bearer ${READ_ONLY_TOKEN}"
    expect:
      result: pass

Environment variables are substituted at runtime. Tokens are never stored or forwarded to MCP Release.

Retry and resilience

Retries are off by default. Enable explicitly with retryOn:

retries:
  maxAttempts: 3
  backoffMs: 1000
  retryOn:
    - rate-limit
    - server-error
    - connection-failure
    - response-timeout

Auth finding codes

Code	Condition
AUTH_REQUIRED	401 with no credentials sent
AUTH_INVALID	401 with credentials — token rejected
AUTH_EXPIRED	401 with explicit unambiguous expiry indicator (error="expired" or error="token_expired")
AUTH_FORBIDDEN	403 — credentials lack required permissions

Note: RFC 6750 error="invalid_token" produces AUTH_INVALID, not AUTH_EXPIRED, because that code covers expired, revoked, and malformed tokens and is too broad for an expiry-specific classification.

New finding codes

Code	Meaning
CONNECT_TIMEOUT	TLS or TCP connection did not complete within the timeout
RESPONSE_TIMEOUT	Connection succeeded but no response received in time
SCENARIO_TIMEOUT	Hard wall-clock scenario budget exceeded (aborts in-flight requests)
RATE_LIMITED	Server returned HTTP 429
RETRY_EXHAUSTED	All configured retry attempts failed
SCENARIO_MISMATCH	Scenario's expect block did not match the actual outcome

GitHub Action

- name: Validate MCP server scenarios
  uses: daranium2020/mcp-release@v0.3.0
  with:
    config: mcp-release.config.yml
  env:
    MCP_TOKEN: ${{ secrets.MCP_TOKEN }}
    READ_ONLY_TOKEN: ${{ secrets.READ_ONLY_TOKEN }}

Links

• npm: @mcp-release/cli@0.3.0
• GitHub Action: daranium2020/mcp-release@v0.3.0
• Website: https://mcprelease.dev
• Documentation: https://mcprelease.dev/docs

MCP Release v0.2.1

What's new in v0.2.1

This release adds transport-aware reports across all execution environments — browser, CLI, and GitHub Actions. Every report now carries a full identity: which tool produced it, which transport was used, when it started, and how long it took.

Transport-aware reports

Every newly generated report includes four new fields:

• transportType — "http" or "stdio"
• executionEnvironment — "browser", "cli", or "github-actions"
• startedAt — ISO 8601 timestamp of when validation began
• mcpReleaseVersion — the version of MCP Release that produced the report

All fields are optional in the schema for backward compatibility with saved reports from earlier versions.

Execution environments

All four entry points now inject their identity into the report:

Entry point	executionEnvironment	mcpReleaseVersion
Website (mcprelease.dev)	browser	0.2.1
CLI (@mcp-release/cli)	cli	0.2.1
GitHub Action (HTTP)	github-actions	0.2.1
GitHub Action (stdio)	github-actions	0.2.1

Remediation hints

Each finding code now maps to a plain-English remediation hint in terminal and Markdown output — telling you exactly what to fix when a check fails or warns.

Stronger redaction

• Local paths — the stdio server label (stdio:<name>) now includes only the basename of the executable. Full paths like /Users/alice/.nvm/bin/node no longer appear in reports.
• Bearer tokens, API keys, and credentials — redacted from URLs, headers, and command arguments.

JSON and Markdown report parity

• Terminal and Markdown reports show transport label (HTTP/SSE vs. stdio), MCP Release version, started-at time, duration, and a summary counts table.
• Stdio reports include a privacy note ("Validation ran locally. No data was sent to MCP Release.") and a tools-not-invoked note.
• For stdio reports, toJson() omits the transport key entirely rather than rendering "transport": null.

Browser report UI

The result card on mcprelease.dev now shows Transport, Environment, and MCP Release version alongside Protocol, Duration, and Started at.

---

Using v0.2.1

Website

https://mcprelease.dev

CLI

npm install -g @mcp-release/cli@0.2.1
mcp-release check https://your-mcp-server.example.com/mcp
mcp-release check --stdio --command "npx -y my-mcp-server"

GitHub Action

- uses: daranium2020/mcp-release@v0.2.1
  with:
    endpoint: https://your-mcp-server.example.com/mcp

- uses: daranium2020/mcp-release@v0.2.1
  with:
    transport: stdio
    command: npx -y my-mcp-server

npm package: @mcp-release/cli@0.2.1

v0.2.0

Added

• Stdio transport validation — validate MCP servers that communicate over stdin/stdout (local spawned processes).
  • CLI: mcp-release check --stdio --command "npx -y my-mcp-server" with optional --cwd <dir>.
  • GitHub Action: transport: stdio input with command and working-directory inputs.
  • packages/core exports runStdioCheck(params, opts) and the StdioCheckParams / StdioCheckOptions types.
• New finding codes:
  • STDIO_UNEXPECTED_OUTPUT (WARNING) — non-JSON lines written to stdout; logs must go to stderr.
  • STDIO_FRAMING_ERROR (FAIL) — valid JSON on stdout that is not a valid MCP message.
  • STDIO_RESPONSE_SIZE_EXCEEDED (FAIL) — stdout exceeded the configured byte limit.
  • STDIO_SHUTDOWN_TIMEOUT (WARNING) — server did not exit after stdin EOF and required SIGKILL.
  • STDIO_PROCESS_ERROR (FAIL) — process could not be spawned or exited unexpectedly.
• Safe environment inheritance: spawned processes receive a curated subset of process.env (HOME, PATH, SHELL, etc.); secrets must be injected via the workflow env block.
• Shell-free command parsing: the command string is tokenized locally without invoking a shell.
• Shutdown sequence: stdin EOF → shutdownTimeoutMs (default 5 s) → SIGTERM → 2 s → SIGKILL.
• 18 new integration tests covering all stdio finding codes.

Notes

• @mcp-release/cli is published as 0.2.0 on npm.
• The web checker at https://mcprelease.dev validates remote HTTP/SSE endpoints only. Stdio validation requires the CLI or GitHub Action.

MCP Release v0.1.2

Patch release for the MCP Release GitHub Action.

Fixes

• Fixed GitHub Action runtime to use Node 24.
• Fixed CommonJS/ESM runtime issue in the GitHub Action bundle.
• Updated Action examples to daranium2020/mcp-release@v0.1.2.
• Updated manual smoke-test workflow to validate v0.1.2.

Notes

• CLI npm package remains @mcp-release/cli@0.1.0.
• No npm publish is required for this release.

MCP Release v0.1.1

GitHub Action release for MCP Release.

GitHub Action

You can now validate MCP servers directly in GitHub Actions:

name: MCP Release Check

on:
  pull_request:
  push:
    branches: [main]

jobs:
  mcp-release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: daranium2020/mcp-release@v0.1.1
        with:
          endpoint: https://your-mcp-server.example.com/mcp

Notes

• Added root action.yml
• Added GitHub Action package
• Updated README and docs
• CLI npm package remains @mcp-release/cli@0.1.0
• No new npm publish is required for this release

MCP Release CLI v0.1.0

First public release of MCP Release CLI.

Install

npm install -g @mcp-release/cli

Usage

mcp-release --version
mcp-release check <server-url-or-fixture>

npx

npx -y @mcp-release/cli --version

Highlights

• Public npm package: @mcp-release/cli
• CLI command: mcp-release
• Release validation for MCP servers
• Fixture-based checks
• Production smoke checks passing